Tag Info

Hot answers tagged

33

An encrypted connection is established first before any HTTP requests are performed (e.g. GET, POST, HEAD, etc.), but the hostname and port are visible. There are many other ways to detect which sites you’re visiting as well, for example: your DNS queries (i.e. they’ll see the IP request for secure.logmein.com) via network monitoring (e.g. ...


18

Just because your traffic is passing though a proxy it doesn't mean you are safe. "Transparent" proxies will transmit your IP address using the X-Forwarded-For HTTP header. There are also cookies that can be used to identify you, such as flash's evercookie. You can even be fingerprinted and tracked by the extensions you have installed and what versions ...


16

Simple Proxy Servers Even a simple proxy will see and log the names of the servers. For example visiting https://example.com/some/address.html will create a request like this from the browser to the proxy server: CONNECT example.org:443 HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:2.0b13pre) ... Proxy-Connection: keep-alive Host: example.org ...


15

As is customary, let's first answer the exact question which was asked. Right now, using HTTPS to connect to the proxy is not widely supported. The squid documentation has some information on the subject; to sum things up: Chrome supports it, but it must be configured through a proxy auto-configuration script because there is no GUI support. This also ...


15

Your forum accepts posts from anybody. That is your core problem. Connecting to your site from various IP throughout the world is trivial, if only by using Tor. Tor provides "high anonymity" in that not only the user's identity is hidden, but each request is anonymous -- you cannot, from the outside, make sure whether two distinct requests are from the same ...


14

In Tor, the user (you) chooses a random path through several nodes for its data. The first node in the path knows your IP address, but not what you send or where. The last node ("exit node") knows the target server address and sees the data (unless SSL is used, of course), but not your IP address. Every node in the path knows only the addresses of the ...


12

It is possible, but it requires some setup. Here is how it is done, and how you can tell. On a corporate computer, where software updates are pushed from a central location, it is possible to send to your computer a "trusted" certificate that will be stored next to the trusted certificate of say, Verising or Entrust. Your company's proxy will hold the ...


11

From the source of https://www.dnsleaktest.com/: <iframe style="display:none" src="https://1segRNWUwPK0Y21Bm1M0.dnsleaktest.com/"></iframe> <iframe style="display:none" src="https://ldJT4mFLnijeQDBhQX2D.dnsleaktest.com/"></iframe> <iframe style="display:none" src="https://nC4B4vChnPXPshinJoyw.dnsleaktest.com/"></iframe> ...


10

Regarding industry accepted practices: (from http://www.rapid7.com/vulndb/lookup/sslv2-and-up-enabled) "SSLv2 has been deprecated and is no longer recommended. Note that neither SSLv2 nor SSLv3 meet the U.S. FIPS 140-2 standard, which governs cryptographic modules for use in federal information systems. Only the newer TLS (Transport Layer Security) ...


10

TL;DR - I think your problem is not related to SSL at all, but you are trying to use a proxy server without the proxy headers. So, if I use stunnel to create an SSL tunnel, and then pass HTTP traffic through it, would it be the same as using HTTPS normally? Yes. We use http over stunnel at work to talk to an https-server. That's a workaround for a bug ...


10

For tracking what is sent and received, you can use a packet sniffer. I use Wireshark (formerly Ethereal).


10

SOCKS itself does nothing to protect your data. It simply allows you to proxy your connections through another connection. The SSH connection from your local computer to the SSH server is what is giving you the security, because all traffic that goes through that connection (including your SOCKS traffic) is encrypted. So, any traffic going between the ...


10

Nope, the exit node can only decrypt the message and make the request, but he is not aware of where the original host is located, the only node that knows where the person is located is the second node. This is due to the layered encryption Tor uses. Every node only knows the next and previous hop, but not the whole path. Nope because of 1 Nope because of 1 ...


10

The way an investigator would trace a multi-hop connection to the original source is to follow each hop, and examine either the logs (if the connection is closed) or the network state (if the connection is ongoing) to see where the next hop goes. This can get very difficult if the hops cross political or jurisdictional boarders, since the cooperation of ...


9

If the connection uses proxies which are correctly implemented, discovering the ip through http or tcp can be difficult. You may have some luck in getting closer to the ip using DNS instead. for If you generate the page dynamically to contain an image located at a domain that you control, e.g. <img src="http://123123.deanonymize.mydomain.com"/> ...


9

I am going to assume you are talking about web browsers' private browsing feature. If that's not what you meant, please elaborate. Be warned that private browsing does not protect your anonymity. This is counter-intuitive, so let me explain. What private browsing does provide: Private browsing is designed to protect you against so-called "browser ...


9

If websense is configured to log it, then yes, they will be able to see where you went, all the URLs you visit. Content is less likely to be viewed - it depends on how websense/proxy is set up - but it can be done. It depends whether the SSL session is from your browser to the server or if it is just to the proxy (effectively running a man in the middle ...


9

You are correct. Some ways for the site to decrease that attack vector would be to... Use an HSTS header to prevent any data from being sent to the site in plaintext. Advertise only the HTTPS URL and do not allow any plaintext connections. This will ensure most bookmarks use encryption. The point being that sites should force SSL from the beginning, ...


8

If you're dealing with HTTP (and/or HTTPS) on Windows, Fiddler might help you there: it hooks into Winsock, so it can tell you the program name it will show you all HTTP(s) requests and responses passing through it and it allows you to modify those, either manually or through scripts


7

Adding to @Piskvor answer - if you need to look at HTTP layer, you should be looking for a intercepting HTTP(s) proxy. There are several such proxies available, both free and commercial ones. If you're on Windows, Fiddler is a good choice. On other platforms you could try: Burp proxy OWASP ZAP OWASP WebScarab All of them will probably be right for the ...


7

This vulnerability forces your proxy to go into an infinite loop, causing a DOS because of exhaustion of local resources like CPU, RAM or any other resource. The reason that it would go into infinite loop is because basically all you're proxy is doing is forwarding requests to someone else. What happens when you tell your proxy to forward the request to ...


7

If the URL uses SSL (i.e. is https://) and use the proxy only for transport, then no, the proxy sees only encrypted data and cannot peek at it. (Unless the proxy tries to feed you with a forged certificate, which requires some prior installation of a collaborating CA in your machine; this may happen in work environments, when your enemy is the local ...


7

The technical solution is to monitor access and block new offending sites as they appear. This isn't a technical problem, it's a policy problem. You cannot possibly block every proxy out there, so you must stop the problem at its source - the employees. You need them to understand why you're blocking those sites, and why they should adhere to your policies. ...


7

They can see all of your SSL traffic unencrypted if they use a BlueCoat proxy or similar. Many large Enterprises do this.


7

If you want a stand alone app, Fiddler works nicely with SSL capture enabled.


7

If you can arrange this ahead of time (or get someone to do it for you), you could set up an SSL proxy (e.g. via stunnel), which would in effect be creating an SSL VPN. Not so different from tunnelling over SSH, I guess, but it is another option.


7

Yes. Java applets can access the original client IP address using java.net.InetAddress.getLocalHost().getHostAddress() and then send it anywhere. See also Are there any addons that disable only some functionality of scripts? and the Tor documentation (e.g., this page) for more discussion of how various web technologies could reveal your original client IP ...


6

With HTTPS, the SSL/TLS tunnel is established first, and HTTP traffic happens only within that tunnel. Some information still leaks: If the client uses a proxy, the connection to the proxy looks like: CONNECT www.example.com:443 with the target server name. Alternatively, the client could send the target server IP address, but this is only marginally less ...



Only top voted, non community-wiki answers of a minimum length are eligible